> ## Documentation Index > Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt > Use this file to discover all available pages before exploring further. # TypeScript SDK > Generated API reference for the hiloop TypeScript SDK — operations and models. This is the exhaustive listing of the `@hiloopai/sdk` package: its generated operations and models, plus the focused `Sandbox` lifecycle and streaming helpers shipped with them. To install the SDK, configure a client, and make your first call, start with [Use the SDKs](/guides/using-the-sdks). Each operation is a function you import and call with `{ client, body }`; request and response bodies are the typed models below. For HTTP paths and status codes, see the [API reference](/api-reference). ## Client ### client > `const` **client**: `Client` ### createClient() > **createClient**(`config?`): `Client` #### Parameters ##### config? `Config` = `{}` #### Returns `Client` ### createConfig() > **createConfig**\<`T`>(`override?`): `Config`\<`Omit`\<`ClientOptions`, keyof `T`> & `T`> #### Type Parameters ##### T `T` *extends* `ClientOptions` = `ClientOptions` #### Parameters ##### override? `Config`\<`Omit`\<`ClientOptions`, keyof `T`> & `T`> = `{}` #### Returns `Config`\<`Omit`\<`ClientOptions`, keyof `T`> & `T`> ### ClientOptions > **ClientOptions** = `object` #### Properties ##### baseUrl > **baseUrl**: `` `${string}://gen` `` | `string` & `object` ### Options\ > **Options**\<`TData`, `ThrowOnError`, `TResponse`> = `Options2`\<`TData`, `ThrowOnError`, `TResponse`> & `object` #### Type Declaration ##### client? > `optional` **client?**: `Client` You can provide a client instance returned by `createClient()` instead of individual options. This might be also useful if you want to implement a custom client. ##### meta? > `optional` **meta?**: keyof `ClientMeta` *extends* `never` ? `Record`\<`string`, `unknown`> : `ClientMeta` You can pass arbitrary values through the `meta` object. This can be used to access values that aren't defined as part of the SDK function. #### Type Parameters ##### TData `TData` *extends* `TDataShape` = `TDataShape` ##### ThrowOnError `ThrowOnError` *extends* `boolean` = `boolean` ##### TResponse `TResponse` = `unknown` ## Sandbox helpers ### tailRun() > **tailRun**(`options`): `Promise`\<`SdkResult`\<`AsyncGenerator`\<`RunTailEvent`, `any`, `any`>>> Tail canonical telemetry events for one run, including resumable SSE cursor ids. #### Parameters ##### options ###### abortSignal? `AbortSignal` ###### client `Client` ###### cursor? `string` ###### lineagePath? `string` ###### runId `string` ###### signal? `string` #### Returns `Promise`\<`SdkResult`\<`AsyncGenerator`\<`RunTailEvent`, `any`, `any`>>> ### RunTailEvent One canonical telemetry event plus its SSE resume metadata. #### Properties ##### data > **data**: `Record`\<`string`, `unknown`> *** ##### event? > `optional` **event?**: `string` *** ##### id? > `optional` **id?**: `string` *** ##### retry? > `optional` **retry?**: `number` ### SdkResult\ > **SdkResult**\<`T`> = \{ `data`: `T`; `error`: `undefined`; `request?`: `Request`; `response?`: `Response`; } | \{ `data`: `undefined`; `error`: `ErrorBody`; `request?`: `Request`; `response?`: `Response`; } #### Type Parameters ##### T `T` ## Operations ### Sandboxes & runtime * `sandboxServiceCreateSandbox` * `sandboxServiceCreateSandboxSnapshot` * `sandboxServiceDeleteSandbox` * `sandboxServiceDeleteSandboxSnapshot` * `sandboxServiceExecSandbox` * `sandboxServiceGetSandbox` * `sandboxServiceListSandboxSnapshots` * `sandboxServiceListSandboxes` * `sandboxServiceUpdateSandbox` ### Volumes * `volumeServiceCreateVolume` * `volumeServiceDeleteVolume` * `volumeServiceGetVolume` * `volumeServiceListVolumes` * `volumeServicePublishVolumeVersion` * `volumeServiceRequestVolumeBlobUploads` * `volumeServiceStartVolumePush` ### Saved & data views * `telemetryViewServiceDeleteDataView` * `telemetryViewServiceListDataViews` * `telemetryViewServicePutDataView` * `telemetryViewServiceRunDataView` ### Annotations * `annotationServiceAnnotate` * `annotationServiceAnnotateRange` * `annotationServiceListAnnotations` ### Annotation schemas * `annotationSchemaServiceArchiveAnnotationSchema` * `annotationSchemaServiceGetAnnotationSchema` * `annotationSchemaServiceListAnnotationSchemas` * `annotationSchemaServiceRegisterAnnotationSchema` ### Runs * `runServiceCompleteRun` * `runServiceGetRun` * `runServiceListRuns` * `runServiceStartRun` ### Secrets * `secretServiceCreateSandboxSecret` * `secretServiceGrantSandboxSecret` * `secretServiceListSandboxSecretGrants` * `secretServiceListSandboxSecrets` * `secretServiceRevokeSandboxSecret` * `secretServiceRotateSandboxSecret` * `secretServiceUngrantSandboxSecret` ### Workloads * `workloadServiceAddWorkloadFederation` * `workloadServiceCreateWorkload` * `workloadServiceDeleteWorkload` * `workloadServiceGetWorkload` * `workloadServiceListWorkloadFederation` * `workloadServiceListWorkloads` * `workloadServiceRemoveWorkloadFederation` * `workloadServiceSetWorkloadLaunchAcl` ### Usage * `usageServiceGetUsageSnapshot` ### Projects * `projectServiceCreateProject` * `projectServiceDeleteProject` * `projectServiceGetProject` * `projectServiceListProjects` * `projectServiceUpdateProject` ### Discovery * `metaServiceGetServiceConfig` ### Identity * `identityServiceWhoAmI` ### Feedback * `feedbackServiceCreateFeedback` ## Models ### AddWorkloadFederationRequest > **AddWorkloadFederationRequest** = `object` #### Properties ##### cloud? > `optional` **cloud?**: `string` Cloud provider: aws, gcp, or azure. *** ##### descriptor? > `optional` **descriptor?**: `WorkloadFederationDescriptor` Strict parameters for the selected cloud. The server derives the canonical audience. *** ##### name? > `optional` **name?**: `string` The registered workload name. ### AddWorkloadFederationResponse > **AddWorkloadFederationResponse** = `object` #### Properties ##### federation\_config? > `optional` **federation\_config?**: `WorkloadFederationConfig` The committed registration. A same-key, same-request retry returns this same row. ### AnnotateRangeRequest > **AnnotateRangeRequest** = `object` A range annotation spanning a window within a run (rather than a single target event). The window is either a pair of wall-clock nanosecond bounds or a pair of event ids whose recorded timestamps become the bounds — supply exactly one form. #### Properties ##### event\_id? > `optional` **event\_id?**: `string` Optional caller-minted `event_id` for the annotation event (a 26-character ULID). Supplying one makes retries safe: re-sending the request with the same `event_id` returns the existing annotation instead of writing a duplicate, so an ambiguous failure (a 5xx or a lost response) can be retried blindly. The id names this logical annotation — never reuse it for different content. Omitted, the server mints a fresh id per call and a retry writes a new annotation. *** ##### payload\_json? > `optional` **payload\_json?**: `string` The annotation payload as a JSON object string; validated against `schema_name`'s registered JSON Schema at ingest. Reserved `hiloop.annotation.*` keys are platform-owned and excluded. *** ##### range\_end\_event\_id? > `optional` **range\_end\_event\_id?**: `string` The `event_id` whose recorded timestamp ends the annotated window. Set together with `range_start_event_id`, and not alongside the nanosecond bounds. *** ##### range\_end\_ns? > `optional` **range\_end\_ns?**: `string` Inclusive end of the annotated window, in wall-clock nanoseconds. Mutually exclusive with the event-pair form. *** ##### range\_start\_event\_id? > `optional` **range\_start\_event\_id?**: `string` The `event_id` whose recorded timestamp starts the annotated window. Both event endpoints must exist in `run_id`; the window bounds are materialized from their timestamps. Set together with `range_end_event_id`, and not alongside the nanosecond bounds. *** ##### range\_start\_ns? > `optional` **range\_start\_ns?**: `string` Inclusive start of the annotated window, in wall-clock nanoseconds. Mutually exclusive with the event-pair form. *** ##### run\_id? > `optional` **run\_id?**: `string` The run (session) the annotation belongs to. *** ##### schema\_name? > `optional` **schema\_name?**: `string` The registered annotation-schema name the payload validates against (the event `name`). ### AnnotateRequest > **AnnotateRequest** = `object` One annotation: run-scoped (optionally targeting a single event within the run) or project-scoped (no run — durable cross-run knowledge that outlives any sandbox). #### Properties ##### event\_id? > `optional` **event\_id?**: `string` Optional caller-minted `event_id` for the annotation event (a 26-character ULID). Supplying one makes retries safe: re-sending the request with the same `event_id` returns the existing annotation instead of writing a duplicate, so an ambiguous failure (a 5xx or a lost response) can be retried blindly. The id names this logical annotation — never reuse it for different content. Omitted, the server mints a fresh id per call and a retry writes a new annotation. *** ##### payload\_json? > `optional` **payload\_json?**: `string` The annotation payload as a JSON object string; validated against `schema_name`'s registered JSON Schema at ingest. Reserved `hiloop.annotation.*` keys are platform-owned and excluded. *** ##### project\_id? > `optional` **project\_id?**: `string` The project a run-less annotation belongs to. Exactly one of `run_id` or `project_id` is set; a project-scoped annotation carries no run lineage and no target event. *** ##### run\_id? > `optional` **run\_id?**: `string` The run (session) the annotation belongs to. Exactly one of `run_id` or `project_id` is set. *** ##### schema\_name? > `optional` **schema\_name?**: `string` The registered annotation-schema name the payload validates against (the event `name`). *** ##### target\_event\_id? > `optional` **target\_event\_id?**: `string` The `event_id` of the single event this annotation is about. Only valid with `run_id`; empty annotates the run (or project) itself. ### AnnotateResponse > **AnnotateResponse** = `object` #### Properties ##### event\_id? > `optional` **event\_id?**: `string` The stable `event_id` of the annotation event (the dedup/lookup key): the caller-minted id when the request carried one, otherwise the freshly server-minted one. ### AnnotationSchema > **AnnotationSchema** = `object` One registered annotation-schema config: a single immutable, versioned row of the registry. #### Properties ##### archived\_at? > `optional` **archived\_at?**: `string` When the config was archived (RFC 3339), or empty if it is still live. *** ##### created\_at? > `optional` **created\_at?**: `string` When the config version was created (RFC 3339). *** ##### description? > `optional` **description?**: `string` An optional human-readable description. *** ##### id? > `optional` **id?**: `string` The config id. *** ##### json\_schema? > `optional` **json\_schema?**: `string` The JSON Schema document (draft 2020-12) as a JSON string. *** ##### name? > `optional` **name?**: `string` The schema name — unique per org across versions (the registered name an annotation names). *** ##### promoted\_fields? > `optional` **promoted\_fields?**: `PromotedField`\[] The fields this schema promotes from the payload into typed columns, each with its server-assigned slot. Empty when the schema promotes nothing. *** ##### version? > `optional` **version?**: `string` The monotonic version within (org, name). The first registration is 1. ### AnnotationSchemaServiceArchiveAnnotationSchemaError > **AnnotationSchemaServiceArchiveAnnotationSchemaError** = `AnnotationSchemaServiceArchiveAnnotationSchemaErrors`\keyof \[`AnnotationSchemaServiceArchiveAnnotationSchemaErrors`] ### AnnotationSchemaServiceArchiveAnnotationSchemaErrors > **AnnotationSchemaServiceArchiveAnnotationSchemaErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### AnnotationSchemaServiceGetAnnotationSchemaError > **AnnotationSchemaServiceGetAnnotationSchemaError** = `AnnotationSchemaServiceGetAnnotationSchemaErrors`\keyof \[`AnnotationSchemaServiceGetAnnotationSchemaErrors`] ### AnnotationSchemaServiceGetAnnotationSchemaErrors > **AnnotationSchemaServiceGetAnnotationSchemaErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### AnnotationSchemaServiceListAnnotationSchemasError > **AnnotationSchemaServiceListAnnotationSchemasError** = `AnnotationSchemaServiceListAnnotationSchemasErrors`\keyof \[`AnnotationSchemaServiceListAnnotationSchemasErrors`] ### AnnotationSchemaServiceListAnnotationSchemasErrors > **AnnotationSchemaServiceListAnnotationSchemasErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### AnnotationSchemaServiceRegisterAnnotationSchemaError > **AnnotationSchemaServiceRegisterAnnotationSchemaError** = `AnnotationSchemaServiceRegisterAnnotationSchemaErrors`\keyof \[`AnnotationSchemaServiceRegisterAnnotationSchemaErrors`] ### AnnotationSchemaServiceRegisterAnnotationSchemaErrors > **AnnotationSchemaServiceRegisterAnnotationSchemaErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### AnnotationServiceAnnotateError > **AnnotationServiceAnnotateError** = `AnnotationServiceAnnotateErrors`\keyof \[`AnnotationServiceAnnotateErrors`] ### AnnotationServiceAnnotateErrors > **AnnotationServiceAnnotateErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### AnnotationServiceAnnotateRangeError > **AnnotationServiceAnnotateRangeError** = `AnnotationServiceAnnotateRangeErrors`\keyof \[`AnnotationServiceAnnotateRangeErrors`] ### AnnotationServiceAnnotateRangeErrors > **AnnotationServiceAnnotateRangeErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### AnnotationServiceListAnnotationsError > **AnnotationServiceListAnnotationsError** = `AnnotationServiceListAnnotationsErrors`\keyof \[`AnnotationServiceListAnnotationsErrors`] ### AnnotationServiceListAnnotationsErrors > **AnnotationServiceListAnnotationsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### ArchiveAnnotationSchemaRequest > **ArchiveAnnotationSchemaRequest** = `object` #### Properties ##### name? > `optional` **name?**: `string` The schema name to archive. *** ##### version? > `optional` **version?**: `string` The specific version to archive. 0 (or omitted) means the latest live version. ### ArchiveAnnotationSchemaResponse > **ArchiveAnnotationSchemaResponse** = `object` #### Properties ##### schema? > `optional` **schema?**: `AnnotationSchema` The archived config version. ### CompleteRunRequest > **CompleteRunRequest** = `object` #### Properties ##### id? > `optional` **id?**: `string` The run to complete. *** ##### status? > `optional` **status?**: `string` The terminal status to record: succeeded, failed, or canceled. ### CompleteRunResponse > **CompleteRunResponse** = `object` #### Properties ##### run? > `optional` **run?**: `Run` The completed run, with its terminal status and end time stamped. ### CreateFeedbackRequest > **CreateFeedbackRequest** = `object` #### Properties ##### actual? > `optional` **actual?**: `string` What actually happened. Optional; at most 10,000 characters. *** ##### body? > `optional` **body?**: `string` Free-form feedback text. Optional; at most 10,000 characters. *** ##### evidence? > `optional` **evidence?**: `string`\[] Correlation keys — run, event, or artifact ids — linking the report to recorded telemetry. Optional; at most 50 entries, each at most 256 characters. *** ##### expected? > `optional` **expected?**: `string` What was expected to happen. Optional; at most 10,000 characters. *** ##### fingerprint? > `optional` **fingerprint?**: `string` A stable, content-derived deduplication key (for example `<surface>/`). Enforced: a submission whose fingerprint already exists returns the original report's id instead of storing (and surfacing) a duplicate, which makes retrying a lost response safe. When omitted, the server derives one from the report's content, so re-sending an identical report also converges. Optional; at most 300 characters. *** ##### hiloop\_version? > `optional` **hiloop\_version?**: `string` The hiloop client version that produced the report. Optional; at most 100 characters. *** ##### repro? > `optional` **repro?**: `string` Steps to reproduce the problem. Optional; at most 10,000 characters. *** ##### severity? > `optional` **severity?**: `string` How severe the problem is. Optional; one of `critical`, `high`, `medium`, or `low`. Leave it empty for general feedback that is not a bug. *** ##### surface? > `optional` **surface?**: `string` The product surface the report is about. Required; one of `cli`, `api`, `web`, `sandbox`, `telemetry`, `annotations`, `docs`, or `other`. *** ##### title? > `optional` **title?**: `string` A short summary of the report. Required; at most 300 characters. ### CreateFeedbackResponse > **CreateFeedbackResponse** = `object` #### Properties ##### id? > `optional` **id?**: `string` The stored report's id. *** ##### relayed? > `optional` **relayed?**: `boolean` Whether the report was surfaced to the team's review channel. The report is stored either way, so a `false` here never means the feedback was lost. ### CreateProjectRequest > **CreateProjectRequest** = `object` #### Properties ##### description? > `optional` **description?**: `string` An optional user-assigned free-text description (at most 4 KiB). Empty leaves the project undescribed. *** ##### name? > `optional` **name?**: `string` The human-readable project name. *** ##### slug? > `optional` **slug?**: `string` The project slug — unique within the caller's organization. ### CreateProjectResponse > **CreateProjectResponse** = `object` #### Properties ##### project? > `optional` **project?**: `Project` The created project. ### CreateSandboxFromImageRequest > **CreateSandboxFromImageRequest** = `object` Create a root sandbox from an OCI image; omitting image starts from the platform default image. #### Properties ##### command? > `optional` **command?**: `string`\[] Argv that replaces the image's own entrypoint as the sandbox's first process. Omit it to run the image's ENTRYPOINT/CMD unchanged, which is what an image built to hold itself open wants. Supply it for an image whose entrypoint runs a task and exits, such as a base OS image or a build tool: a sandbox is something you attach to, and it lives only as long as its first process. The argv is executed directly rather than through a shell, so pipes and redirection belong inside a command you name explicitly. The executable must not be empty; at most 256 entries, each at most 4096 characters. *** ##### idle\_timeout\_seconds? > `optional` **idle\_timeout\_seconds?**: `number` Idle duration in seconds after which a running sandbox is stopped. Omit it to use the deployment default; when the deployment has no default, idle stopping is disabled. Values are from 60 through 86400. *** ##### image? > `optional` **image?**: `string` The unmodified OCI image reference to start from. *** ##### metadata? > `optional` **metadata?**: `object` Caller-owned metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### name? > `optional` **name?**: `string` Optional customer-supplied name, unique among the project's sandboxes that have not finished deleting. It must be 1-63 characters: lowercase letters or digits, with interior hyphens allowed. Omit it to leave the sandbox unnamed; the server never generates a name. A duplicate returns 409 name\_conflict; a terminated sandbox's name is free to reuse, and its record keeps the name for history. *** ##### network\_access? > `optional` **network\_access?**: `"public"` | `"gateway_only"` | `"none"` Outbound-network posture. Omit it to use public access. *** ##### placement\_class? > `optional` **placement\_class?**: `"standard"` | `"non_preemptible"` Capacity posture for this sandbox. Omit it to use standard placement. *** ##### ports? > `optional` **ports?**: `number`\[] Unique guest TCP ports in the range 1-65535. Returned endpoints are authenticated private session-plane connections, not public preview URLs. *** ##### resources? > `optional` **resources?**: `ResourceSpec` Requested compute resources. Omitted fields resolve to deployment defaults at admission, and the resolved shape is echoed on every Sandbox response. A GPU request is rejected with 422 unsupported\_capability when the deployment cannot schedule accelerators. *** ##### secrets? > `optional` **secrets?**: `SandboxSecretBinding`\[] Pre-registered secrets to bind for proof-bound request-time delivery. *** ##### shared\_filesystems? > `optional` **shared\_filesystems?**: `SandboxSharedFilesystemMount`\[] Deployment-registered shared filesystems to mount. Shared filesystems are external to this sandbox's snapshots; durable storage is required for the sandbox's private runtime state. *** ##### storage\_class? > `optional` **storage\_class?**: `"standard"` | `"durable"` Storage behavior for the sandbox. Omit it to use durable storage when restoring a snapshot, or standard storage for an image/platform-default create. *** ##### ttl\_seconds? > `optional` **ttl\_seconds?**: `number` Sandbox lifetime in seconds. Omit it to use the deployment default. *** ##### volumes? > `optional` **volumes?**: `SandboxVolumeMount`\[] Pre-registered volumes to mount, each pinned to its current version at admission. *** ##### workspace\_capacity\_gib? > `optional` **workspace\_capacity\_gib?**: `number` Durable workspace capacity in whole GiB. A root create may omit it to use the deployment default; a snapshot create inherits the snapshot-time value. A legacy snapshot whose capacity predates stamping requires an explicit value. This field is valid only with durable storage; standard storage has no persistent workspace claim. ### CreateSandboxFromSnapshotRequest > **CreateSandboxFromSnapshotRequest** = `object` Create a child sandbox from an existing snapshot. #### Properties ##### command? > `optional` **command?**: `string`\[] Argv that replaces the image's own entrypoint as the sandbox's first process. Omit it to run the image's ENTRYPOINT/CMD unchanged, which is what an image built to hold itself open wants. Supply it for an image whose entrypoint runs a task and exits, such as a base OS image or a build tool: a sandbox is something you attach to, and it lives only as long as its first process. The argv is executed directly rather than through a shell, so pipes and redirection belong inside a command you name explicitly. The executable must not be empty; at most 256 entries, each at most 4096 characters. *** ##### idle\_timeout\_seconds? > `optional` **idle\_timeout\_seconds?**: `number` Idle duration in seconds after which a running sandbox is stopped. Omit it to use the deployment default; when the deployment has no default, idle stopping is disabled. Values are from 60 through 86400. *** ##### image\_override? > `optional` **image\_override?**: `string` The image to run the restored workspace on, when it should not be the one the snapshot recorded. Only meaningful with snapshot\_id: a snapshot carries workspace bytes, and this names the runtime they are materialized onto, which is how a sandbox takes a newer base image without losing what is in its workspace. Omit it to run the image the snapshot recorded. *** ##### metadata? > `optional` **metadata?**: `object` Caller-owned metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### name? > `optional` **name?**: `string` Optional customer-supplied name, unique among the project's sandboxes that have not finished deleting. It must be 1-63 characters: lowercase letters or digits, with interior hyphens allowed. Omit it to leave the sandbox unnamed; the server never generates a name. A duplicate returns 409 name\_conflict; a terminated sandbox's name is free to reuse, and its record keeps the name for history. *** ##### network\_access? > `optional` **network\_access?**: `"public"` | `"gateway_only"` | `"none"` Outbound-network posture. Omit it to use public access. *** ##### placement\_class? > `optional` **placement\_class?**: `"standard"` | `"non_preemptible"` Capacity posture for this sandbox. Omit it to use standard placement. *** ##### ports? > `optional` **ports?**: `number`\[] Unique guest TCP ports in the range 1-65535. Returned endpoints are authenticated private session-plane connections, not public preview URLs. *** ##### resources? > `optional` **resources?**: `ResourceSpec` Requested compute resources. Omitted fields resolve to deployment defaults at admission, and the resolved shape is echoed on every Sandbox response. A GPU request is rejected with 422 unsupported\_capability when the deployment cannot schedule accelerators. *** ##### secrets? > `optional` **secrets?**: `SandboxSecretBinding`\[] Pre-registered secrets to bind for proof-bound request-time delivery. *** ##### shared\_filesystems? > `optional` **shared\_filesystems?**: `SandboxSharedFilesystemMount`\[] Deployment-registered shared filesystems to mount. Shared filesystems are external to this sandbox's snapshots; durable storage is required for the sandbox's private runtime state. *** ##### snapshot\_id > **snapshot\_id**: `string` The snapshot to restore as a new child sandbox. *** ##### storage\_class? > `optional` **storage\_class?**: `"standard"` | `"durable"` Storage behavior for the sandbox. Omit it to use durable storage when restoring a snapshot, or standard storage for an image/platform-default create. *** ##### ttl\_seconds? > `optional` **ttl\_seconds?**: `number` Sandbox lifetime in seconds. Omit it to use the deployment default. *** ##### volumes? > `optional` **volumes?**: `SandboxVolumeMount`\[] Pre-registered volumes to mount, each pinned to its current version at admission. *** ##### workspace\_capacity\_gib? > `optional` **workspace\_capacity\_gib?**: `number` Durable workspace capacity in whole GiB. A root create may omit it to use the deployment default; a snapshot create inherits the snapshot-time value. A legacy snapshot whose capacity predates stamping requires an explicit value. This field is valid only with durable storage; standard storage has no persistent workspace claim. ### CreateSandboxResponse > **CreateSandboxResponse** = `object` #### Properties ##### id > **id**: `string` The new sandbox id. Poll GetSandbox with this id for observed lifecycle state. *** ##### request\_state > **request\_state**: `"requested"` The accepted mutation-request state, distinct from observed sandbox lifecycle state. *** ##### run\_id > **run\_id**: `string` The ambient run that receives telemetry captured for this sandbox. An idempotent create retry returns the same run id. ### CreateSandboxSecretRequest > **CreateSandboxSecretRequest** = `object` #### Properties ##### delivery? > `optional` **delivery?**: `"SANDBOX_SECRET_DELIVERY_UNSPECIFIED"` | `"SANDBOX_SECRET_DELIVERY_SECRET_EGRESS"` | `"SANDBOX_SECRET_DELIVERY_MODEL_GATEWAY"` | `"SANDBOX_SECRET_DELIVERY_SANDBOX_ENVIRONMENT"` The only trusted data plane allowed to release this secret. Defaults to generic secret egress. *** ##### dest\_host? > `optional` **dest\_host?**: `string` The exact public HTTPS destination. Must be a bare DNS hostname such as `api.openai.com`, not a URL or IP address; stored in canonical lowercase form. Must be empty for sandbox-environment delivery. *** ##### name? > `optional` **name?**: `string` The secret name — unique within the caller's organization. *** ##### value? > `optional` **value?**: `string` The secret value. WRITE-ONLY: stored encrypted for proof-bound delivery and never returned by these management APIs. ### CreateSandboxSecretResponse > **CreateSandboxSecretResponse** = `object` #### Properties ##### secret? > `optional` **secret?**: `SandboxSecret` The created secret's metadata. The value is NOT echoed back. ### CreateSandboxSnapshotBody > **CreateSandboxSnapshotBody** = `object` #### Properties ##### name? > `optional` **name?**: `string` Optional human-readable snapshot name used by list filtering, from 1 through 128 characters. *** ##### wait\_remote? > `optional` **wait\_remote?**: `boolean` When true, wait for confirmed remote replication before returning the receipt. When false, return after the local storage snapshot exists. The wait is bounded by wait\_timeout\_seconds. *** ##### wait\_timeout\_seconds? > `optional` **wait\_timeout\_seconds?**: `number` Remote-replication wait bound in seconds, from 1 through 25. At the deadline, return the same snapshot id with truthful local durability rather than holding the request longer. ### CreateSandboxSnapshotResponse > **CreateSandboxSnapshotResponse** = `object` #### Properties ##### durability > **durability**: `"local"` | `"replicated"` Durability proven before this receipt was returned. *** ##### snapshot\_id > **snapshot\_id**: `string` The new immutable snapshot id. ### CreateVolumeRequest > **CreateVolumeRequest** = `object` #### Properties ##### description? > `optional` **description?**: `string` An optional user-assigned free-text description (at most 4 KiB). Empty leaves the volume undescribed. *** ##### name? > `optional` **name?**: `string` The volume name — unique within the project (letters, digits, dots, dashes, underscores; at most 100 characters). *** ##### project\_id? > `optional` **project\_id?**: `string` The project the volume belongs to. *** ##### quota\_bytes? > `optional` **quota\_bytes?**: `string` Storage quota in bytes (required). A quota, not an allocation; at most 2 TiB per volume. ### CreateVolumeResponse > **CreateVolumeResponse** = `object` #### Properties ##### volume? > `optional` **volume?**: `Volume` The created volume. ### CreateWorkloadRequest > **CreateWorkloadRequest** = `object` #### Properties ##### description? > `optional` **description?**: `string` A free-text description of what the workload is for. Optional. *** ##### name? > `optional` **name?**: `string` The workload name to register — unique within the organization. Lowercase letters, digits, `.`, `_`, and `-`; must start and end with a letter or digit; at most 100 characters. ### CreateWorkloadResponse > **CreateWorkloadResponse** = `object` #### Properties ##### workload? > `optional` **workload?**: `Workload` The registered workload, carrying the default launch ACL (any org member may launch). ### DataView > **DataView** = `object` A structured data view: a named, versioned spec that compiles 1:1 to a safe query. #### Properties ##### description? > `optional` **description?**: `string` A human description, surfaced in the console switcher. *** ##### name? > `optional` **name?**: `string` The view name, unique within an organization among non-deleted views. *** ##### spec? > `optional` **spec?**: `object` The data-view spec as opaque JSON — the engine's tagged `DataViewSpec`: a raw `Sql` `SELECT`, plus opaque render config. Carried as a Struct so the spec schema lives in ONE place (the engine's serde types); the service never re-models it. Re-validated against the current column allowlist on store and on every run, so a view referencing a dropped column fails closed with INVALID\_ARGUMENT rather than serving a stale result. ###### Index Signature \[`key`: `string`]: `unknown` *** ##### spec\_version? > `optional` **spec\_version?**: `string` Monotonic per-edit version; the store bumps it on each upsert. ### DeleteDataViewResponse > **DeleteDataViewResponse** = `object` #### Index Signature \[`key`: `string`]: `unknown` ### DeleteProjectResponse > **DeleteProjectResponse** = `object` The delete's effect report: how many of each dependent resource the call actually removed. All counts are zero for a non-cascading delete (it only ever removes a project with no dependents). #### Properties ##### api\_keys\_deleted? > `optional` **api\_keys\_deleted?**: `string` The number of project-scoped API keys deleted (keys scoped to the whole organization are untouched). *** ##### runs\_deleted? > `optional` **runs\_deleted?**: `string` The number of runs deleted. *** ##### secrets\_deleted? > `optional` **secrets\_deleted?**: `string` The number of project-scoped secrets deleted. *** ##### volumes\_deleted? > `optional` **volumes\_deleted?**: `string` The number of volumes deleted. ### DeleteSandboxResponse > **DeleteSandboxResponse** = `object` #### Properties ##### id > **id**: `string` The sandbox id whose deletion was accepted. *** ##### request\_state > **request\_state**: `"requested"` The accepted mutation-request state, distinct from observed sandbox lifecycle state. ### DeleteSandboxSnapshotResponse > **DeleteSandboxSnapshotResponse** = `object` #### Index Signature \[`key`: `string`]: `unknown` ### DeleteVolumeResponse > **DeleteVolumeResponse** = `object` #### Index Signature \[`key`: `string`]: `unknown` ### DeleteWorkloadResponse > **DeleteWorkloadResponse** = `object` #### Index Signature \[`key`: `string`]: `unknown` ### ErrorBody > **ErrorBody** = `object` #### Properties ##### code > **code**: `string` Stable machine-readable error code in snake\_case. *** ##### details? > `optional` **details?**: `ErrorDetails` *** ##### message > **message**: `string` Human-readable description; clients must not parse it. *** ##### request\_id? > `optional` **request\_id?**: `string` Correlation id present on server faults. ### ErrorDetails > **ErrorDetails** = `object` #### Properties ##### quota? > `optional` **quota?**: `QuotaDetails` ### ExecSandboxBody > **ExecSandboxBody** = `object` #### Properties ##### cmd > **cmd**: `string`\[] Command and arguments. The first entry is a non-empty executable; at most 256 entries are accepted and each entry is at most 4096 characters. *** ##### secret\_environment? > `optional` **secret\_environment?**: `SandboxExecSecretEnvironment`\[] Secret references released atomically into the child environment. No value crosses this public API. Omit for ordinary execution. *** ##### timeout\_seconds? > `optional` **timeout\_seconds?**: `number` Execution timeout in whole seconds, from 1 through 3600. Omit it to use the server default; sub-second budgets are outside this version. ### ExecSandboxCompletedResponse > **ExecSandboxCompletedResponse** = `object` Buffered output and the real exit code from a completed command; truncated reports output loss independently. #### Properties ##### exit > **exit**: `number` The process exit code for a completed command, including zero. *** ##### stderr > **stderr**: `string` Buffered standard error. It may contain partial output on a timeout or an indeterminate outcome. *** ##### stdout > **stdout**: `string` Buffered standard output. It may contain partial output on a timeout or an indeterminate outcome. *** ##### truncated > **truncated**: `boolean` Whether stdout or stderr was truncated at the server-configured combined output cap. The default cap is no more than 1 MiB. Truncation does not replace the real process outcome. ### ExecSandboxIndeterminateResponse > **ExecSandboxIndeterminateResponse** = `object` The command was dispatched but its outcome could not be read, so no exit code is reported; any output collected first is still returned. It may have completed: do not re-run a command that is unsafe to repeat without checking, or send an Idempotency-Key so a retry replays instead of re-executing. #### Properties ##### indeterminate > **indeterminate**: `SandboxExecIndeterminate` Presence means the command was dispatched but its outcome could not be read. The command may have completed; this is never a statement that it did not run. *** ##### stderr > **stderr**: `string` Buffered standard error. It may contain partial output on a timeout or an indeterminate outcome. *** ##### stdout > **stdout**: `string` Buffered standard output. It may contain partial output on a timeout or an indeterminate outcome. *** ##### truncated > **truncated**: `boolean` Whether stdout or stderr was truncated at the server-configured combined output cap. The default cap is no more than 1 MiB. Truncation does not replace the real process outcome. ### ExecSandboxResponse > **ExecSandboxResponse** = `ExecSandboxCompletedResponse` | `ExecSandboxTimedOutResponse` | `ExecSandboxIndeterminateResponse` ### ExecSandboxTimedOutResponse > **ExecSandboxTimedOutResponse** = `object` Partial buffered output from a timed-out command, with no exit code; truncated reports output loss independently. #### Properties ##### stderr > **stderr**: `string` Buffered standard error. It may contain partial output on a timeout or an indeterminate outcome. *** ##### stdout > **stdout**: `string` Buffered standard output. It may contain partial output on a timeout or an indeterminate outcome. *** ##### timeout > **timeout**: `SandboxExecTimeout` Presence means the execution exceeded timeout\_seconds before a process exit was observed. *** ##### truncated > **truncated**: `boolean` Whether stdout or stderr was truncated at the server-configured combined output cap. The default cap is no more than 1 MiB. Truncation does not replace the real process outcome. ### FeedbackServiceCreateFeedbackError > **FeedbackServiceCreateFeedbackError** = `FeedbackServiceCreateFeedbackErrors`\keyof \[`FeedbackServiceCreateFeedbackErrors`] ### FeedbackServiceCreateFeedbackErrors > **FeedbackServiceCreateFeedbackErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### GetAnnotationSchemaResponse > **GetAnnotationSchemaResponse** = `object` #### Properties ##### schema? > `optional` **schema?**: `AnnotationSchema` The requested config version. ### GetProjectResponse > **GetProjectResponse** = `object` #### Properties ##### project? > `optional` **project?**: `Project` The requested project. ### GetRunResponse > **GetRunResponse** = `object` #### Properties ##### run? > `optional` **run?**: `Run` The requested run. ### GetSandboxResponse > **GetSandboxResponse** = `object` #### Properties ##### sandbox > **sandbox**: `Sandbox` The requested sandbox, read through to runtime authority when the product record is not yet visible. ### GetUsageSnapshotResponse > **GetUsageSnapshotResponse** = `object` #### Properties ##### snapshot? > `optional` **snapshot?**: `UsageSnapshot` ### GetVolumeResponse > **GetVolumeResponse** = `object` #### Properties ##### volume? > `optional` **volume?**: `Volume` The requested volume. ### GetWorkloadResponse > **GetWorkloadResponse** = `object` #### Properties ##### workload? > `optional` **workload?**: `Workload` The registered workload. ### GrantSandboxSecretRequest > **GrantSandboxSecretRequest** = `object` #### Properties ##### id? > `optional` **id?**: `string` The secret id to grant. *** ##### subject\_id? > `optional` **subject\_id?**: `string` The principal's immutable id within subject\_kind. *** ##### subject\_kind? > `optional` **subject\_kind?**: `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_UNSPECIFIED"` | `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_USER"` | `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_SERVICE_ACCOUNT"` | `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_WORKLOAD"` The principal kind. ### GrantSandboxSecretResponse > **GrantSandboxSecretResponse** = `object` #### Properties ##### grant? > `optional` **grant?**: `SandboxSecretGrant` The exact idempotently-created grant. A secret accepts at most 200 exact grants, including the creator grant. ### IdentityServiceWhoAmIError > **IdentityServiceWhoAmIError** = `IdentityServiceWhoAmIErrors`\keyof \[`IdentityServiceWhoAmIErrors`] ### IdentityServiceWhoAmIErrors > **IdentityServiceWhoAmIErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### ListAnnotationSchemasResponse > **ListAnnotationSchemasResponse** = `object` #### Properties ##### schemas? > `optional` **schemas?**: `AnnotationSchema`\[] The configs in the caller's organization. By default the latest live version per name; with include\_archived, every version, newest first. ### ListAnnotationsResponse > **ListAnnotationsResponse** = `object` #### Properties ##### annotations? > `optional` **annotations?**: `object`\[] One annotation per row, newest first. Each row carries the annotation's identity and anchor (`event_id`, `run_id` — absent on project-scoped rows — `project_id`, `lineage_path`, the schema `name`, `ts_wall_ns`, `principal`), its target (`target_event_id`, or the range bounds `range_start_ns`/`range_end_ns` plus `range_start_event_id`/`range_end_event_id` when the range was event-bounded), and the schema-validated payload as a raw JSON object string under `payload_json` — the exact bytes that were annotated (the write-side `payload_json`), so payload values of every JSON type, including 64-bit integers, read back unchanged. Row fields are encoded canonically: snake\_case keys, 64-bit integers as decimal strings, absent fields omitted. ###### Index Signature \[`key`: `string`]: `unknown` *** ##### skipped? > `optional` **skipped?**: `SkippedAnnotation`\[] Stored rows this listing could not decode (a legacy or corrupt storage shape), one entry per skipped row. The readable annotations above still serve in full; a listing that omits rows says so here rather than failing outright or dropping them silently. Empty on a healthy store. *** ##### superseded\_count? > `optional` **superseded\_count?**: `string` How many stored versions the default latest-wins view hid because a newer write shares their supersession key. Zero when nothing was superseded, and always zero with `history` (which returns every version). A non-zero count means acked writes are stored but not shown here — list with `history` to read them all. ### ListDataViewsResponse > **ListDataViewsResponse** = `object` #### Properties ##### views? > `optional` **views?**: `DataView`\[] The organization's structured data views. ### ListProjectsResponse > **ListProjectsResponse** = `object` #### Properties ##### next\_page\_token? > `optional` **next\_page\_token?**: `string` The token to pass as page\_token to fetch the next page. Empty when there are no more results. *** ##### projects? > `optional` **projects?**: `Project`\[] The projects on this page, newest first. ### ListRunsResponse > **ListRunsResponse** = `object` #### Properties ##### next\_page\_token? > `optional` **next\_page\_token?**: `string` The token to pass as page\_token to fetch the next page. Empty when there are no more results. *** ##### runs? > `optional` **runs?**: `Run`\[] The runs on this page, newest first. ### ListSandboxSecretGrantsResponse > **ListSandboxSecretGrantsResponse** = `object` #### Properties ##### grants? > `optional` **grants?**: `SandboxSecretGrant`\[] At most 200 exact grants, sorted by kind and immutable id. ### ListSandboxSecretsResponse > **ListSandboxSecretsResponse** = `object` #### Properties ##### next\_page\_token? > `optional` **next\_page\_token?**: `string` The token to pass as page\_token to fetch the next page. Empty when there are no more results. *** ##### secrets? > `optional` **secrets?**: `SandboxSecret`\[] The secrets on this page, newest first — metadata only, never the value. ### ListSandboxSnapshotsResponse > **ListSandboxSnapshotsResponse** = `object` #### Properties ##### next\_page\_token > **next\_page\_token**: `string` Token for the next page. Empty means this is the final page. *** ##### snapshots > **snapshots**: `SandboxSnapshot`\[] The snapshots on this page, ordered by created\_at descending then id descending, including their parent lineage edges. ### ListSandboxesResponse > **ListSandboxesResponse** = `object` #### Properties ##### next\_page\_token > **next\_page\_token**: `string` Token for the next page. Empty means this is the final page. *** ##### sandboxes > **sandboxes**: `Sandbox`\[] The sandboxes on this page, ordered by created\_at descending then id descending. ### ListVolumesResponse > **ListVolumesResponse** = `object` #### Properties ##### next\_page\_token? > `optional` **next\_page\_token?**: `string` The token to pass as page\_token to fetch the next page. Empty when there are no more results. *** ##### volumes? > `optional` **volumes?**: `Volume`\[] The volumes on this page, newest first. ### ListWorkloadFederationResponse > **ListWorkloadFederationResponse** = `object` #### Properties ##### federation\_configs? > `optional` **federation\_configs?**: `WorkloadFederationConfig`\[] The workload's live registrations, in creation order. ### ListWorkloadsResponse > **ListWorkloadsResponse** = `object` #### Properties ##### workloads? > `optional` **workloads?**: `Workload`\[] The organization's registered workloads, by name. ### MetaServiceGetServiceConfigError > **MetaServiceGetServiceConfigError** = `MetaServiceGetServiceConfigErrors`\keyof \[`MetaServiceGetServiceConfigErrors`] ### MetaServiceGetServiceConfigErrors > **MetaServiceGetServiceConfigErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### MetadataReplacement > **MetadataReplacement** = `object` A presence-bearing complete replacement for caller-owned metadata. #### Properties ##### entries? > `optional` **entries?**: `object` Replacement metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` ### OrgRef > **OrgRef** = `object` The organization the caller acts in. #### Properties ##### id? > `optional` **id?**: `string` The organization id. *** ##### slug? > `optional` **slug?**: `string` The organization slug. ### Principal > **Principal** = `object` The acting principal, as resolved from the caller's credential by the API edge. The API trusts the edge-resolved identity; it does not re-authenticate. #### Properties ##### email? > `optional` **email?**: `string` The user's primary email. Empty for a service-account or workload principal. *** ##### id? > `optional` **id?**: `string` The principal's stable id: the user's id for a user, the API key's id for a service account or a workload. *** ##### key\_id? > `optional` **key\_id?**: `string` The presented API key's id. Empty for a browser-session login (no key is involved). *** ##### key\_name? > `optional` **key\_name?**: `string` The presented API key's name — how this principal is displayed in listings and attribution. Empty for a browser-session login. *** ##### kind? > `optional` **kind?**: `string` The kind of principal: "user" (a human identity), "service\_account" (a machine credential not bound to a user), or "workload" (a credential bound to a registered workload identity). *** ##### workload\_name? > `optional` **workload\_name?**: `string` The bound workload's registered name — how a workload principal is displayed in listings and attribution. Empty unless the presented credential is bound to a registered workload. ### Project > **Project** = `object` A project record (the subset the API returns). #### Properties ##### created\_at? > `optional` **created\_at?**: `string` When the project was created (RFC 3339). *** ##### created\_by? > `optional` **created\_by?**: `string` Stable id of the principal that created the project — the API key (or user) that performed the create, recorded server-side, never client-supplied. Resolve it to a display name via the principals listing. Empty for projects created before attribution was recorded. *** ##### description? > `optional` **description?**: `string` User-assigned free-text description (at most 4 KiB). Empty when unset. *** ##### id? > `optional` **id?**: `string` The project id. *** ##### last\_run\_at? > `optional` **last\_run\_at?**: `string` When the most recent run in the project was created (RFC 3339), or empty when the project has no runs yet. *** ##### name? > `optional` **name?**: `string` The human-readable project name. *** ##### run\_count? > `optional` **run\_count?**: `string` The total number of runs in the project, computed server-side across all of the project's runs (not just one page). *** ##### slug? > `optional` **slug?**: `string` The project slug — unique within the org. *** ##### updated\_at? > `optional` **updated\_at?**: `string` When the project was last updated (RFC 3339). Equal to created\_at until the first update. *** ##### version? > `optional` **version?**: `string` Optimistic-concurrency version, bumped on every update. Echo it back as the `If-Match` request header to make a later update conditional — if the project changed meanwhile the server rejects the update with error code `precondition_failed` instead of overwriting. ### ProjectServiceCreateProjectError > **ProjectServiceCreateProjectError** = `ProjectServiceCreateProjectErrors`\keyof \[`ProjectServiceCreateProjectErrors`] ### ProjectServiceCreateProjectErrors > **ProjectServiceCreateProjectErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### ProjectServiceDeleteProjectError > **ProjectServiceDeleteProjectError** = `ProjectServiceDeleteProjectErrors`\keyof \[`ProjectServiceDeleteProjectErrors`] ### ProjectServiceDeleteProjectErrors > **ProjectServiceDeleteProjectErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### ProjectServiceGetProjectError > **ProjectServiceGetProjectError** = `ProjectServiceGetProjectErrors`\keyof \[`ProjectServiceGetProjectErrors`] ### ProjectServiceGetProjectErrors > **ProjectServiceGetProjectErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### ProjectServiceListProjectsError > **ProjectServiceListProjectsError** = `ProjectServiceListProjectsErrors`\keyof \[`ProjectServiceListProjectsErrors`] ### ProjectServiceListProjectsErrors > **ProjectServiceListProjectsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### ProjectServiceUpdateProjectError > **ProjectServiceUpdateProjectError** = `ProjectServiceUpdateProjectErrors`\keyof \[`ProjectServiceUpdateProjectErrors`] ### ProjectServiceUpdateProjectErrors > **ProjectServiceUpdateProjectErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### PromotedField > **PromotedField** = `object` One org-declared field promoted from the annotation payload into a typed column for filter/sort/join speed. Unpromoted fields stay queryable from the JSON payload. The set of promoted fields is part of the immutable schema version, and slot bindings are stable across versions: a field keeps its slot in every later version (its type is permanent), a newly promoted field takes a never-used slot, and a slot is never re-bound to a different field, so rows written under any version stay readable by field name. #### Properties ##### bloom? > `optional` **bloom?**: `boolean` Request a point-lookup bloom filter for this field (str only; default false). Useful for a high-cardinality promoted id queried by exact match. *** ##### field? > `optional` **field?**: `string` The payload field name to promote (e.g. "score"). Must be a field the schema's payload carries. *** ##### identity? > `optional` **identity?**: `boolean` Whether this field is part of the latest-wins supersession identity. The default supersession key is the annotated target plus the schema name; declaring identity fields refines it (e.g. mark an "annotator" field identity to keep the latest write per annotator). Identity fields must be promoted, since dedup partitions on the typed column. *** ##### slot? > `optional` **slot?**: `string` The server-assigned physical column the field binds to (read-only; ignored on a register request, populated on the stored/returned schema). *** ##### type? > `optional` **type?**: `"PROMOTED_TYPE_UNSPECIFIED"` | `"PROMOTED_TYPE_STR"` | `"PROMOTED_TYPE_F64"` | `"PROMOTED_TYPE_I64"` | `"PROMOTED_TYPE_BOOL"` The storage type to lift the field into. ### PublishVolumeVersionRequest > **PublishVolumeVersionRequest** = `object` #### Properties ##### push\_id? > `optional` **push\_id?**: `string` The push handle from StartVolumePush, naming the uploaded manifest. *** ##### volume\_id? > `optional` **volume\_id?**: `string` The volume to publish the version on. ### PublishVolumeVersionResponse > **PublishVolumeVersionResponse** = `object` #### Properties ##### version? > `optional` **version?**: `VolumeVersion` The published version, now the volume's current version. ### PutDataViewRequest > **PutDataViewRequest** = `object` Create or replace a data view by name (upsert). The path `{name}` is authoritative; a `name` inside the body is ignored. #### Properties ##### description? > `optional` **description?**: `string` An optional human description. *** ##### name? > `optional` **name?**: `string` The view name (unique within the organization); supplied by the path. *** ##### spec? > `optional` **spec?**: `object` The data-view spec (opaque JSON, the engine's tagged `DataViewSpec`). Compile-validated before store. ###### Index Signature \[`key`: `string`]: `unknown` ### QueryResponse > **QueryResponse** = `object` #### Properties ##### columns? > `optional` **columns?**: `string`\[] The result set's declared column names, in projection order. Present even when a column is NULL in every row (per-row nulls are omitted), so a selected-but-empty column stays visible. *** ##### rows? > `optional` **rows?**: `object`\[] One flat JSON object per result row: column name -> bare scalar value, nulls omitted, 64-bit integers as decimal strings. For aggregate surfaces the columns are the grouping columns plus one per aggregate metric (e.g. "sum\_input\_tokens"). Reused by the view service. ###### Index Signature \[`key`: `string`]: `unknown` ### QuotaDetails > **QuotaDetails** = `object` #### Properties ##### current? > `optional` **current?**: `number` *** ##### limit > **limit**: `number` *** ##### metric > **metric**: `string` *** ##### reserved? > `optional` **reserved?**: `number` *** ##### retry\_after\_seconds? > `optional` **retry\_after\_seconds?**: `number` ### QuotaLimit > **QuotaLimit** = `object` One org quota limit and its current occupancy, when occupancy is meaningful. #### Properties ##### current? > `optional` **current?**: `string` Current usage. Omitted for rate limits. *** ##### limit? > `optional` **limit?**: `string` Configured cap for the caller's organization. *** ##### metric? > `optional` **metric?**: `string` Stable metric name used by quota errors and usage displays. ### RegisterAnnotationSchemaRequest > **RegisterAnnotationSchemaRequest** = `object` #### Properties ##### description? > `optional` **description?**: `string` An optional human-readable description for this version. *** ##### json\_schema? > `optional` **json\_schema?**: `string` The JSON Schema document (draft 2020-12) as a JSON string. Must be a JSON object. *** ##### name? > `optional` **name?**: `string` The schema name — unique per organization across versions. A new registration of an existing name creates the next version; an unseen name starts at version 1. *** ##### promoted\_fields? > `optional` **promoted\_fields?**: `PromotedField`\[] The payload fields to promote into typed columns for this version. The caller sets field/type/identity/bloom; the server assigns each field's slot, keeping a previously promoted field's slot and type. Registration is rejected if a field re-declares a different type, or if the schema has bound more fields of a type, across all its versions, than the slot pool holds. ### RegisterAnnotationSchemaResponse > **RegisterAnnotationSchemaResponse** = `object` #### Properties ##### schema? > `optional` **schema?**: `AnnotationSchema` The registered config version. ### RemoveWorkloadFederationResponse > **RemoveWorkloadFederationResponse** = `object` #### Index Signature \[`key`: `string`]: `unknown` ### RequestVolumeBlobUploadsRequest > **RequestVolumeBlobUploadsRequest** = `object` #### Properties ##### blobs? > `optional` **blobs?**: `VolumeBlobRef`\[] The blobs to upload, at most 512 per request. Repeat the call in batches for larger pushes; it is read-only on the volume itself, so batches may run concurrently. *** ##### volume\_id? > `optional` **volume\_id?**: `string` The volume the blobs are being pushed for. ### RequestVolumeBlobUploadsResponse > **RequestVolumeBlobUploadsResponse** = `object` #### Properties ##### expires\_in\_seconds? > `optional` **expires\_in\_seconds?**: `number` How long the returned upload URLs stay valid, in seconds. *** ##### uploads? > `optional` **uploads?**: `VolumeBlobUpload`\[] One entry per distinct requested digest: either already present, or an upload URL. ### ResourceSpec > **ResourceSpec** = `object` Declarative compute resources for a sandbox. Requests are burstable: the sandbox is guaranteed its requested shape and may use idle node capacity beyond it. #### Properties ##### cpu\_millis? > `optional` **cpu\_millis?**: `number` Requested CPU in milliCPU, from 50 through 128000. 1000 milliCPU is one vCPU. Omit it to use the deployment default. *** ##### gpus? > `optional` **gpus?**: `ResourceSpecGpus` Requested accelerators. Omit it to request none. *** ##### memory\_mb? > `optional` **memory\_mb?**: `number` Requested memory in MB (mebibytes: 1024 MB = 1 GiB), from 1 through 1048576. Omit it to use the deployment default. ### ResourceSpecGpus > **ResourceSpecGpus** = `object` Requested accelerators. #### Properties ##### count? > `optional` **count?**: `number` Integral accelerator count. *** ##### models? > `optional` **models?**: `string`\[] Ordered fallback list of acceptable accelerator models. An empty list accepts any advertised model. ### RevokeSandboxSecretResponse > **RevokeSandboxSecretResponse** = `object` #### Properties ##### secret? > `optional` **secret?**: `SandboxSecret` The revoked secret's metadata (with revoked\_at set). ### RotateSandboxSecretRequest > **RotateSandboxSecretRequest** = `object` #### Properties ##### id? > `optional` **id?**: `string` The secret id to rotate. *** ##### value? > `optional` **value?**: `string` The new secret value. WRITE-ONLY: stored encrypted as a new version and never returned. ### RotateSandboxSecretResponse > **RotateSandboxSecretResponse** = `object` #### Properties ##### secret? > `optional` **secret?**: `SandboxSecret` The rotated secret's metadata (with the new current\_version and rotated\_at set). ### Run > **Run** = `object` A run record (the subset the API returns). Intentionally carries no cost or spend roll-up: the product is generic and does not surface cost by default. #### Properties ##### created\_at? > `optional` **created\_at?**: `string` When the run record was created (RFC 3339). *** ##### created\_by? > `optional` **created\_by?**: `string` The stable id of the principal that created the run — the API key (or user) that performed the start, recorded server-side. Empty when unrecorded. *** ##### ended\_at? > `optional` **ended\_at?**: `string` When the run finished (RFC 3339), empty if it is still in flight. *** ##### executing\_kind? > `optional` **executing\_kind?**: `string` The executing identity's kind: `user`, `service_account`, or `workload`. Empty on runs that predate executing-identity recording. *** ##### executing\_principal? > `optional` **executing\_principal?**: `string` The stable id of the identity this run executes AS: the registered workload's id when the launch declared one, otherwise the launcher's own principal id (matching created\_by). Empty on runs that predate executing-identity recording. *** ##### id? > `optional` **id?**: `string` The run id (a client-supplied ULID, shared with telemetry). *** ##### label? > `optional` **label?**: `string` An optional human-readable label. *** ##### last\_activity\_at? > `optional` **last\_activity\_at?**: `string` When the run last showed a liveness signal (RFC 3339): the time of its most recent telemetry event, or started\_at for a run that has emitted no events yet. Derived at read time, and only for a `running` run. Empty for every other run, and empty when the signal is temporarily unavailable. *** ##### lineage\_path? > `optional` **lineage\_path?**: `string` The materialized path of run ids from the root to this run, as a dotted label (e.g. "root\_ulid.child\_ulid"). Sorts in creation order and addresses the subtree by prefix. *** ##### parent\_run\_id? > `optional` **parent\_run\_id?**: `string` The run this run continued from. Empty for a tree root. *** ##### project\_id? > `optional` **project\_id?**: `string` The project the run belongs to. *** ##### root\_run\_id? > `optional` **root\_run\_id?**: `string` The root of this run's tree (equal to id for a root). Lets the whole tree resolve in one indexed lookup. *** ##### stale? > `optional` **stale?**: `boolean` True when last\_activity\_at is older than the staleness window (15 minutes): the run still reads `running` — no terminal state is ever recorded on the creator's behalf — but its creator has gone quiet, so readers should render it as `running (stale)`. Always false when last\_activity\_at is empty. *** ##### started\_at? > `optional` **started\_at?**: `string` When the run started executing (RFC 3339), empty if it has not started. *** ##### status? > `optional` **status?**: `string` The run lifecycle status: pending, running, succeeded, failed, or canceled. ### RunServiceCompleteRunError > **RunServiceCompleteRunError** = `RunServiceCompleteRunErrors`\keyof \[`RunServiceCompleteRunErrors`] ### RunServiceCompleteRunErrors > **RunServiceCompleteRunErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### RunServiceGetRunError > **RunServiceGetRunError** = `RunServiceGetRunErrors`\keyof \[`RunServiceGetRunErrors`] ### RunServiceGetRunErrors > **RunServiceGetRunErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### RunServiceListRunsError > **RunServiceListRunsError** = `RunServiceListRunsErrors`\keyof \[`RunServiceListRunsErrors`] ### RunServiceListRunsErrors > **RunServiceListRunsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### RunServiceStartRunError > **RunServiceStartRunError** = `RunServiceStartRunErrors`\keyof \[`RunServiceStartRunErrors`] ### RunServiceStartRunErrors > **RunServiceStartRunErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### Sandbox > **Sandbox** = `SandboxFromImage` | `SandboxFromSnapshot` One organization-scoped sandbox and its observed state. ### SandboxActivity > **SandboxActivity** = `object` The most recent activity observed against a sandbox. Activity is what the service saw: a command submitted or still running, a session opened or still held, or a change to the sandbox itself. Work happening inside the sandbox that the service cannot see does not count. #### Properties ##### at? > `optional` **at?**: `string` When the activity was last observed, in RFC 3339 form. While a command is running or a session is held open, this advances periodically rather than only at the end. *** ##### source? > `optional` **source?**: `"exec"` | `"session"` | `"update"` What produced it. ### SandboxEndpoint > **SandboxEndpoint** = `object` A port endpoint assigned to a sandbox. #### Properties ##### port > **port**: `number` The guest TCP port exposed by this endpoint. *** ##### url > **url**: `string` The authenticated URL clients use to reach the port. ### SandboxErrorBody > **SandboxErrorBody** = `object` #### Properties ##### code > **code**: `string` Stable machine-readable error code in snake\_case. *** ##### message > **message**: `string` Human-readable description; clients must not parse it. *** ##### request\_id > **request\_id**: `string` Correlation id for support and diagnostics. ### SandboxExecIndeterminate > **SandboxExecIndeterminate** = `object` Presence marker returned when the command was dispatched but its execution channel was lost before an outcome could be read, so the service cannot say what the command did. This is not a failure to run. The command may have run to completion, and any output collected before the channel was lost is still returned. Treat it as "unknown", never as "did not run": re-issuing a command that is not safe to run twice requires an Idempotency-Key, which replays the recorded outcome instead of executing again. #### Index Signature \[`key`: `string`]: `never` ### SandboxExecSecretEnvironment > **SandboxExecSecretEnvironment** = `object` One write-only secret reference mapped to one environment variable for this execution. The secret value is resolved by the server and never appears in this request. #### Properties ##### secret\_name? > `optional` **secret\_name?**: `string` Name of an active sandbox-environment secret in the caller's organization, at most 128 bytes. *** ##### variable\_name? > `optional` **variable\_name?**: `string` POSIX environment variable name populated in the child process, at most 128 bytes. ### SandboxExecTimeout > **SandboxExecTimeout** = `object` Presence marker returned when an execution exceeded its requested timeout. #### Index Signature \[`key`: `string`]: `never` ### SandboxFromImage > **SandboxFromImage** = `object` A root sandbox created from an OCI image. #### Properties ##### created\_at > **created\_at**: `string` When the sandbox was accepted, in RFC 3339 form. *** ##### created\_by? > `optional` **created\_by?**: `string` Stable id of the principal that created the sandbox: the presented API key's id, or the session user's id. Empty when the creator was not recorded. *** ##### endpoints > **endpoints**: `SandboxEndpoint`\[] Authenticated private session-plane port endpoints. Empty until an endpoint is available; these are not public preview URLs. *** ##### expires\_at? > `optional` **expires\_at?**: `string` The expiry time in RFC 3339 form. Omitted when the sandbox has no expiry. *** ##### id > **id**: `string` The stable sandbox id. *** ##### idle\_deadline? > `optional` **idle\_deadline?**: `string` The next idle-stop deadline in RFC 3339 form. Omitted while the sandbox is not running or the controller has not reported its activity clock yet. *** ##### idle\_timeout\_seconds? > `optional` **idle\_timeout\_seconds?**: `number` The resolved idle-stop duration in seconds. Omitted when idle stopping is disabled. *** ##### image > **image**: `string` The OCI image reference used by a root sandbox. *** ##### last\_activity? > `optional` **last\_activity?**: `SandboxActivity` The most recent activity the service observed against this sandbox. Omitted when none has been observed since the sandbox was created. *** ##### lineage\_path > **lineage\_path**: `string` The immutable dotted lineage from the root sandbox to this sandbox. An image-created root uses its own id. A snapshot-created child appends its id to the parent snapshot's lineage\_path. *** ##### metadata > **metadata**: `object` Caller-owned metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### name? > `optional` **name?**: `string` Customer-supplied name, unique among the project's sandboxes that have not finished deleting. Omitted when no name was supplied at creation. *** ##### placement\_class > **placement\_class**: `"standard"` | `"non_preemptible"` The immutable capacity posture selected at creation. *** ##### resources? > `optional` **resources?**: `ResourceSpec` The compute shape resolved at admission, deployment defaults included. gpus is present only when the sandbox has accelerators. Omitted only on records that predate resource stamping. *** ##### shared\_filesystems? > `optional` **shared\_filesystems?**: `SandboxSharedFilesystemMount`\[] Shared filesystem selections admitted for this sandbox. These echo only the logical id, subdirectory, and guest path; deployment claim names and backend coordinates stay private. *** ##### ssh? > `optional` **ssh?**: `SandboxSshConnection` SSH connection information. Omitted until the sandbox can accept a session. *** ##### state > **state**: `"requested"` | `"reserved"` | `"materializing"` | `"ready"` | `"running"` | `"stopped"` | `"terminating"` | `"failed"` | `"terminated"` | `"quarantined"` | `"attention"` The current observed lifecycle state. *** ##### state\_reason? > `optional` **state\_reason?**: `SandboxStateReason` Failure or quarantine reason. Omitted for lifecycle states that need no explanation. *** ##### storage\_class > **storage\_class**: `"standard"` | `"durable"` The backing storage behavior selected at creation. *** ##### updated\_at > **updated\_at**: `string` When the sandbox record last changed, in RFC 3339 form. *** ##### volumes > **volumes**: `SandboxPinnedVolume`\[] Admitted volumes with the immutable version pinned for this sandbox. *** ##### workload\_image > **workload\_image**: `string` The OCI image the workload is actually running. For a root sandbox this repeats the source above; for one restored from a snapshot it is the resolved image, which is the snapshot's own unless the create named a different one. Read this rather than inferring an image from lineage — a restored sandbox does not necessarily run what its parent ran. *** ##### workspace\_capacity\_gib? > `optional` **workspace\_capacity\_gib?**: `number` Durable workspace capacity in whole GiB. Omitted for standard storage and records that predate capacity stamping. ### SandboxFromSnapshot > **SandboxFromSnapshot** = `object` A child sandbox created from a snapshot. #### Properties ##### created\_at > **created\_at**: `string` When the sandbox was accepted, in RFC 3339 form. *** ##### created\_by? > `optional` **created\_by?**: `string` Stable id of the principal that created the sandbox: the presented API key's id, or the session user's id. Empty when the creator was not recorded. *** ##### endpoints > **endpoints**: `SandboxEndpoint`\[] Authenticated private session-plane port endpoints. Empty until an endpoint is available; these are not public preview URLs. *** ##### expires\_at? > `optional` **expires\_at?**: `string` The expiry time in RFC 3339 form. Omitted when the sandbox has no expiry. *** ##### id > **id**: `string` The stable sandbox id. *** ##### idle\_deadline? > `optional` **idle\_deadline?**: `string` The next idle-stop deadline in RFC 3339 form. Omitted while the sandbox is not running or the controller has not reported its activity clock yet. *** ##### idle\_timeout\_seconds? > `optional` **idle\_timeout\_seconds?**: `number` The resolved idle-stop duration in seconds. Omitted when idle stopping is disabled. *** ##### last\_activity? > `optional` **last\_activity?**: `SandboxActivity` The most recent activity the service observed against this sandbox. Omitted when none has been observed since the sandbox was created. *** ##### lineage\_path > **lineage\_path**: `string` The immutable dotted lineage from the root sandbox to this sandbox. An image-created root uses its own id. A snapshot-created child appends its id to the parent snapshot's lineage\_path. *** ##### metadata > **metadata**: `object` Caller-owned metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### name? > `optional` **name?**: `string` Customer-supplied name, unique among the project's sandboxes that have not finished deleting. Omitted when no name was supplied at creation. *** ##### placement\_class > **placement\_class**: `"standard"` | `"non_preemptible"` The immutable capacity posture selected at creation. *** ##### resources? > `optional` **resources?**: `ResourceSpec` The compute shape resolved at admission, deployment defaults included. gpus is present only when the sandbox has accelerators. Omitted only on records that predate resource stamping. *** ##### shared\_filesystems? > `optional` **shared\_filesystems?**: `SandboxSharedFilesystemMount`\[] Shared filesystem selections admitted for this sandbox. These echo only the logical id, subdirectory, and guest path; deployment claim names and backend coordinates stay private. *** ##### snapshot\_id > **snapshot\_id**: `string` The parent snapshot restored by a child sandbox. *** ##### ssh? > `optional` **ssh?**: `SandboxSshConnection` SSH connection information. Omitted until the sandbox can accept a session. *** ##### state > **state**: `"requested"` | `"reserved"` | `"materializing"` | `"ready"` | `"running"` | `"stopped"` | `"terminating"` | `"failed"` | `"terminated"` | `"quarantined"` | `"attention"` The current observed lifecycle state. *** ##### state\_reason? > `optional` **state\_reason?**: `SandboxStateReason` Failure or quarantine reason. Omitted for lifecycle states that need no explanation. *** ##### storage\_class > **storage\_class**: `"standard"` | `"durable"` The backing storage behavior selected at creation. *** ##### updated\_at > **updated\_at**: `string` When the sandbox record last changed, in RFC 3339 form. *** ##### volumes > **volumes**: `SandboxPinnedVolume`\[] Admitted volumes with the immutable version pinned for this sandbox. *** ##### workload\_image > **workload\_image**: `string` The OCI image the workload is actually running. For a root sandbox this repeats the source above; for one restored from a snapshot it is the resolved image, which is the snapshot's own unless the create named a different one. Read this rather than inferring an image from lineage — a restored sandbox does not necessarily run what its parent ran. *** ##### workspace\_capacity\_gib? > `optional` **workspace\_capacity\_gib?**: `number` Durable workspace capacity in whole GiB. Omitted for standard storage and records that predate capacity stamping. ### SandboxNetworkAccessReceipt > **SandboxNetworkAccessReceipt** = `object` Synchronous observation that policy objects select the exact live pod incarnation. This is not dataplane enforcement proof; phase-sensitive clients probe the network after it. #### Properties ##### network\_access? > `optional` **network\_access?**: `"public"` | `"gateway_only"` | `"none"` *** ##### pod\_resource\_version? > `optional` **pod\_resource\_version?**: `string` *** ##### pod\_uid? > `optional` **pod\_uid?**: `string` *** ##### policies? > `optional` **policies?**: `SandboxNetworkPolicyObservation`\[] ### SandboxNetworkPolicyObservation > **SandboxNetworkPolicyObservation** = `object` One policy-controller observation that the exact live pod is selected by an egress policy. #### Properties ##### policy\_endpoint\_name? > `optional` **policy\_endpoint\_name?**: `string` *** ##### policy\_endpoint\_resource\_version? > `optional` **policy\_endpoint\_resource\_version?**: `string` *** ##### policy\_endpoint\_uid? > `optional` **policy\_endpoint\_uid?**: `string` *** ##### policy\_name? > `optional` **policy\_name?**: `string` ### SandboxPinnedVolume > **SandboxPinnedVolume** = `object` A mounted volume as admitted on a sandbox, including the immutable pinned version. #### Properties ##### name? > `optional` **name?**: `string` The mounted volume's name as resolved at admission. Empty when the volume had no name. *** ##### target\_path > **target\_path**: `string` The absolute mount path inside the sandbox. *** ##### version > **version**: `string` The immutable volume version pinned at admission. *** ##### volume\_id > **volume\_id**: `string` The mounted volume id. ### SandboxQuotaErrorBody > **SandboxQuotaErrorBody** = `object` #### Properties ##### code > **code**: `string` Stable machine-readable error code in snake\_case. *** ##### limit > **limit**: `number` Configured limit for the caller's organization. *** ##### message > **message**: `string` Human-readable description; clients must not parse it. *** ##### metric > **metric**: `string` Stable name of the exhausted quota metric. *** ##### request\_id > **request\_id**: `string` Correlation id for support and diagnostics. *** ##### retry\_after\_seconds > **retry\_after\_seconds**: `number` Seconds to wait before retrying. ### SandboxSecret > **SandboxSecret** = `object` A sandbox-secret record — metadata only, never the value. #### Properties ##### created\_at? > `optional` **created\_at?**: `string` When the secret was created (RFC 3339). *** ##### current\_version? > `optional` **current\_version?**: `string` The current version number. Starts at 1 and increments on each rotation. *** ##### delivery? > `optional` **delivery?**: `"SANDBOX_SECRET_DELIVERY_UNSPECIFIED"` | `"SANDBOX_SECRET_DELIVERY_SECRET_EGRESS"` | `"SANDBOX_SECRET_DELIVERY_MODEL_GATEWAY"` | `"SANDBOX_SECRET_DELIVERY_SANDBOX_ENVIRONMENT"` The only trusted data plane allowed to release this secret. *** ##### dest\_host? > `optional` **dest\_host?**: `string` Exact public HTTPS host to which proof-bound delivery is bound. Empty for sandbox-environment delivery, which is bound to an authorized sandbox execution instead of a network destination. *** ##### expires\_at? > `optional` **expires\_at?**: `string` When the secret expires, if an expiry is set (RFC 3339). *** ##### id? > `optional` **id?**: `string` The secret id. *** ##### name? > `optional` **name?**: `string` The human-readable secret name — unique within the organization. The sandbox spec references it by name. *** ##### revoked\_at? > `optional` **revoked\_at?**: `string` When the secret was revoked, if it has been (RFC 3339). A revoked secret cannot be delivered. *** ##### rotated\_at? > `optional` **rotated\_at?**: `string` When the secret was last rotated, if ever (RFC 3339). ### SandboxSecretBinding > **SandboxSecretBinding** = `object` A pre-registered secret bound when the sandbox is created. #### Properties ##### name > **name**: `string` The registered secret name. Admission binds its exact proof-bound destination and use grant. ### SandboxSecretGrant > **SandboxSecretGrant** = `object` One exact principal allowed to use one secret. Secret metadata visibility does not imply this authority. #### Properties ##### secret\_id? > `optional` **secret\_id?**: `string` The granted secret id. *** ##### subject\_id? > `optional` **subject\_id?**: `string` The principal's immutable id within subject\_kind. *** ##### subject\_kind? > `optional` **subject\_kind?**: `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_UNSPECIFIED"` | `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_USER"` | `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_SERVICE_ACCOUNT"` | `"SANDBOX_SECRET_GRANT_SUBJECT_KIND_WORKLOAD"` The principal kind. ### SandboxServiceCreateSandboxError > **SandboxServiceCreateSandboxError** = `SandboxServiceCreateSandboxErrors`\keyof \[`SandboxServiceCreateSandboxErrors`] ### SandboxServiceCreateSandboxErrors > **SandboxServiceCreateSandboxErrors** = `object` #### Properties ##### 429 > **429**: `SandboxQuotaErrorBody` Sandbox admission rejected by a quota limit. *** ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceCreateSandboxSnapshotError > **SandboxServiceCreateSandboxSnapshotError** = `SandboxServiceCreateSandboxSnapshotErrors`\keyof \[`SandboxServiceCreateSandboxSnapshotErrors`] ### SandboxServiceCreateSandboxSnapshotErrors > **SandboxServiceCreateSandboxSnapshotErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceDeleteSandboxError > **SandboxServiceDeleteSandboxError** = `SandboxServiceDeleteSandboxErrors`\keyof \[`SandboxServiceDeleteSandboxErrors`] ### SandboxServiceDeleteSandboxErrors > **SandboxServiceDeleteSandboxErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceDeleteSandboxSnapshotError > **SandboxServiceDeleteSandboxSnapshotError** = `SandboxServiceDeleteSandboxSnapshotErrors`\keyof \[`SandboxServiceDeleteSandboxSnapshotErrors`] ### SandboxServiceDeleteSandboxSnapshotErrors > **SandboxServiceDeleteSandboxSnapshotErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceExecSandboxError > **SandboxServiceExecSandboxError** = `SandboxServiceExecSandboxErrors`\keyof \[`SandboxServiceExecSandboxErrors`] ### SandboxServiceExecSandboxErrors > **SandboxServiceExecSandboxErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceGetSandboxError > **SandboxServiceGetSandboxError** = `SandboxServiceGetSandboxErrors`\keyof \[`SandboxServiceGetSandboxErrors`] ### SandboxServiceGetSandboxErrors > **SandboxServiceGetSandboxErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceListSandboxSnapshotsError > **SandboxServiceListSandboxSnapshotsError** = `SandboxServiceListSandboxSnapshotsErrors`\keyof \[`SandboxServiceListSandboxSnapshotsErrors`] ### SandboxServiceListSandboxSnapshotsErrors > **SandboxServiceListSandboxSnapshotsErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceListSandboxesError > **SandboxServiceListSandboxesError** = `SandboxServiceListSandboxesErrors`\keyof \[`SandboxServiceListSandboxesErrors`] ### SandboxServiceListSandboxesErrors > **SandboxServiceListSandboxesErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxServiceUpdateSandboxError > **SandboxServiceUpdateSandboxError** = `SandboxServiceUpdateSandboxErrors`\keyof \[`SandboxServiceUpdateSandboxErrors`] ### SandboxServiceUpdateSandboxErrors > **SandboxServiceUpdateSandboxErrors** = `object` #### Properties ##### default > **default**: `SandboxErrorBody` An error using the successor flat API error envelope. ### SandboxSharedFilesystemMount > **SandboxSharedFilesystemMount** = `object` A deployment-registered shared filesystem mounted when the sandbox is created. The deployment resolves filesystem\_id to its storage backend. Credentials and backend coordinates are never accepted from the sandbox caller or exposed inside the sandbox. #### Properties ##### filesystem\_id? > `optional` **filesystem\_id?**: `string` Deployment-registered filesystem id. *** ##### subdirectory? > `optional` **subdirectory?**: `string` Existing relative directory within the filesystem to mount. The directory must already exist when the sandbox pod starts. *** ##### target\_path? > `optional` **target\_path?**: `string` Guest path at which the selected directory is mounted. It is either /workspace, which moves the sandbox's private durable workspace to /private, or a normalized path below /mnt, which leaves the private workspace at /workspace. Other paths are refused so shared storage cannot replace image executables, configuration, or platform-owned mounts. ### SandboxSnapshot > **SandboxSnapshot** = `object` One immutable sandbox snapshot and its lineage edge. #### Properties ##### created\_at > **created\_at**: `string` When the snapshot was created, in RFC 3339 form. *** ##### durability > **durability**: `"local"` | `"replicated"` The strongest durability currently confirmed for this snapshot. *** ##### id > **id**: `string` The stable snapshot id. *** ##### image > **image**: `string` The workload image behind this snapshot's lineage: the root sandbox's OCI image reference, inherited by every child sandbox created from this snapshot. *** ##### lineage\_path > **lineage\_path**: `string` The source sandbox's immutable lineage\_path. A child created from this snapshot appends its id to this value, making snapshot parentage the derivation source for sandbox lineage. *** ##### name? > `optional` **name?**: `string` Optional human-readable name supplied when the snapshot was created. *** ##### parent\_snapshot\_id? > `optional` **parent\_snapshot\_id?**: `string` The snapshot from which the source sandbox was created. Omitted for an image-created root. *** ##### source\_sandbox\_id > **source\_sandbox\_id**: `string` The sandbox whose state this snapshot records. ### SandboxSshConnection > **SandboxSshConnection** = `object` SSH connection information for a ready or running sandbox. #### Properties ##### host > **host**: `string` The session-plane hostname. *** ##### port > **port**: `number` The session-plane TCP port. *** ##### user > **user**: `string` The SSH username assigned to the sandbox session. ### SandboxStateReason > **SandboxStateReason** = `object` A stable reason attached to a failed or quarantined lifecycle state. #### Properties ##### code > **code**: `string` Stable machine-readable reason code in snake\_case. *** ##### message > **message**: `string` Human-readable detail; clients must not parse it. ### SandboxVolumeMount > **SandboxVolumeMount** = `object` A pre-registered volume mounted when the sandbox is created. #### Properties ##### target\_path > **target\_path**: `string` The absolute path at which the volume is mounted inside the sandbox. *** ##### volume\_id > **volume\_id**: `string` The volume id to mount. Its current immutable version is pinned at admission. ### SecretServiceCreateSandboxSecretError > **SecretServiceCreateSandboxSecretError** = `SecretServiceCreateSandboxSecretErrors`\keyof \[`SecretServiceCreateSandboxSecretErrors`] ### SecretServiceCreateSandboxSecretErrors > **SecretServiceCreateSandboxSecretErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### SecretServiceGrantSandboxSecretError > **SecretServiceGrantSandboxSecretError** = `SecretServiceGrantSandboxSecretErrors`\keyof \[`SecretServiceGrantSandboxSecretErrors`] ### SecretServiceGrantSandboxSecretErrors > **SecretServiceGrantSandboxSecretErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### SecretServiceListSandboxSecretGrantsError > **SecretServiceListSandboxSecretGrantsError** = `SecretServiceListSandboxSecretGrantsErrors`\keyof \[`SecretServiceListSandboxSecretGrantsErrors`] ### SecretServiceListSandboxSecretGrantsErrors > **SecretServiceListSandboxSecretGrantsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### SecretServiceListSandboxSecretsError > **SecretServiceListSandboxSecretsError** = `SecretServiceListSandboxSecretsErrors`\keyof \[`SecretServiceListSandboxSecretsErrors`] ### SecretServiceListSandboxSecretsErrors > **SecretServiceListSandboxSecretsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### SecretServiceRevokeSandboxSecretError > **SecretServiceRevokeSandboxSecretError** = `SecretServiceRevokeSandboxSecretErrors`\keyof \[`SecretServiceRevokeSandboxSecretErrors`] ### SecretServiceRevokeSandboxSecretErrors > **SecretServiceRevokeSandboxSecretErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### SecretServiceRotateSandboxSecretError > **SecretServiceRotateSandboxSecretError** = `SecretServiceRotateSandboxSecretErrors`\keyof \[`SecretServiceRotateSandboxSecretErrors`] ### SecretServiceRotateSandboxSecretErrors > **SecretServiceRotateSandboxSecretErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### SecretServiceUngrantSandboxSecretError > **SecretServiceUngrantSandboxSecretError** = `SecretServiceUngrantSandboxSecretErrors`\keyof \[`SecretServiceUngrantSandboxSecretErrors`] ### SecretServiceUngrantSandboxSecretErrors > **SecretServiceUngrantSandboxSecretErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### SetWorkloadLaunchAclRequest > **SetWorkloadLaunchAclRequest** = `object` #### Properties ##### acl? > `optional` **acl?**: `WorkloadLaunchAcl` The launch ACL to set, replacing the workload's current one. A RESTRICTED policy must list at least one launcher; a MEMBERS policy must not list any. *** ##### name? > `optional` **name?**: `string` The registered workload name. ### SetWorkloadLaunchAclResponse > **SetWorkloadLaunchAclResponse** = `object` #### Properties ##### workload? > `optional` **workload?**: `Workload` The workload with its updated launch ACL. ### SkippedAnnotation > **SkippedAnnotation** = `object` A stored annotation row a listing skipped because it could not be decoded, with the row's stored event id and the decode failure. Skipped rows are surfaced, never silently dropped: the listing stays available while naming exactly what it could not serve. #### Properties ##### event\_id? > `optional` **event\_id?**: `string` The stored `event_id` of the row that failed to decode. *** ##### reason? > `optional` **reason?**: `string` Why the row could not be decoded. ### StartRunRequest > **StartRunRequest** = `object` #### Properties ##### execute\_as\_workload? > `optional` **execute\_as\_workload?**: `string` Optional registered workload name to run as. When set, the run is attributed to that workload (the caller must hold launch rights on it and the name must be registered); when empty, the run executes as the caller's own identity. The executing identity is always declared here, never inferred from the command. *** ##### label? > `optional` **label?**: `string` An optional human-readable label. *** ##### parent\_run\_id? > `optional` **parent\_run\_id?**: `string` Optional parent run to continue the tree from. Empty starts a new tree root. *** ##### project\_id? > `optional` **project\_id?**: `string` The project the new run belongs to. ### StartRunResponse > **StartRunResponse** = `object` #### Properties ##### run? > `optional` **run?**: `Run` The newly started run, with its lineage fields resolved. ### StartVolumePushRequest > **StartVolumePushRequest** = `object` #### Properties ##### volume\_id? > `optional` **volume\_id?**: `string` The volume to push a new version to. ### StartVolumePushResponse > **StartVolumePushResponse** = `object` #### Properties ##### expires\_in\_seconds? > `optional` **expires\_in\_seconds?**: `number` How long the upload URL stays valid, in seconds. *** ##### manifest\_upload\_url? > `optional` **manifest\_upload\_url?**: `string` Short-lived pre-authorized URL to PUT the manifest (the JSON file listing: per file its path, mode, size, content digest, and chunk list) to. The URL is bound to this push's staging location; the request needs no additional credentials. *** ##### max\_manifest\_bytes? > `optional` **max\_manifest\_bytes?**: `string` The largest manifest the server accepts for this push, in bytes. *** ##### push\_id? > `optional` **push\_id?**: `string` The push handle. Pass it to PublishVolumeVersion once the manifest and all content blobs are uploaded. ### TelemetryViewServiceDeleteDataViewError > **TelemetryViewServiceDeleteDataViewError** = `TelemetryViewServiceDeleteDataViewErrors`\keyof \[`TelemetryViewServiceDeleteDataViewErrors`] ### TelemetryViewServiceDeleteDataViewErrors > **TelemetryViewServiceDeleteDataViewErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### TelemetryViewServiceListDataViewsError > **TelemetryViewServiceListDataViewsError** = `TelemetryViewServiceListDataViewsErrors`\keyof \[`TelemetryViewServiceListDataViewsErrors`] ### TelemetryViewServiceListDataViewsErrors > **TelemetryViewServiceListDataViewsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### TelemetryViewServicePutDataViewError > **TelemetryViewServicePutDataViewError** = `TelemetryViewServicePutDataViewErrors`\keyof \[`TelemetryViewServicePutDataViewErrors`] ### TelemetryViewServicePutDataViewErrors > **TelemetryViewServicePutDataViewErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### TelemetryViewServiceRunDataViewError > **TelemetryViewServiceRunDataViewError** = `TelemetryViewServiceRunDataViewErrors`\keyof \[`TelemetryViewServiceRunDataViewErrors`] ### TelemetryViewServiceRunDataViewErrors > **TelemetryViewServiceRunDataViewErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### UngrantSandboxSecretResponse > **UngrantSandboxSecretResponse** = `object` #### Index Signature \[`key`: `string`]: `unknown` ### UpdateProjectRequest > **UpdateProjectRequest** = `object` #### Properties ##### description? > `optional` **description?**: `string` The new free-text description (at most 4 KiB). An empty value clears it; omitted leaves it unchanged. *** ##### id? > `optional` **id?**: `string` The project id to update. *** ##### name? > `optional` **name?**: `string` The new human-readable name (the slug is immutable). Omitted leaves the name unchanged. ### UpdateProjectResponse > **UpdateProjectResponse** = `object` #### Properties ##### project? > `optional` **project?**: `Project` The updated project. ### UpdateSandboxIdleTimeoutRequest > **UpdateSandboxIdleTimeoutRequest** = `object` A sandbox update that includes a new idle-stop duration. #### Properties ##### idle\_timeout\_seconds > **idle\_timeout\_seconds**: `number` New idle-stop duration in seconds, from 60 through 86400. Omit it to leave the current value unchanged. *** ##### metadata? > `optional` **metadata?**: `object` Replacement metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### state? > `optional` **state?**: `"running"` | `"stopped"` New desired lifecycle state. Omit it to leave lifecycle state unchanged. *** ##### ttl\_seconds? > `optional` **ttl\_seconds?**: `number` New positive lifetime in seconds from the time of this update. Omit it to leave expiry unchanged; zero is invalid. ### UpdateSandboxMetadataRequest > **UpdateSandboxMetadataRequest** = `object` A sandbox update that includes a metadata replacement. #### Properties ##### idle\_timeout\_seconds? > `optional` **idle\_timeout\_seconds?**: `number` New idle-stop duration in seconds, from 60 through 86400. Omit it to leave the current value unchanged. *** ##### metadata > **metadata**: `object` Replacement metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### state? > `optional` **state?**: `"running"` | `"stopped"` New desired lifecycle state. Omit it to leave lifecycle state unchanged. *** ##### ttl\_seconds? > `optional` **ttl\_seconds?**: `number` New positive lifetime in seconds from the time of this update. Omit it to leave expiry unchanged; zero is invalid. ### UpdateSandboxNetworkAccessRequest > **UpdateSandboxNetworkAccessRequest** = `object` A retryable sandbox update that selects one closed outbound-network profile. #### Properties ##### network\_access > **network\_access**: `"public"` | `"gateway_only"` | `"none"` Replacement outbound-network posture. It must be the only update field and returns only after the deployment's policy controller selects the exact live pod incarnation. ### UpdateSandboxResponse > **UpdateSandboxResponse** = `object` #### Properties ##### id > **id**: `string` The sandbox id whose update was accepted. *** ##### network\_access\_receipt? > `optional` **network\_access\_receipt?**: `SandboxNetworkAccessReceipt` Present after policy objects select the exact live pod incarnation. *** ##### request\_state > **request\_state**: `"requested"` The accepted mutation-request state, distinct from observed sandbox lifecycle state. ### UpdateSandboxStateRequest > **UpdateSandboxStateRequest** = `object` A sandbox update that includes a lifecycle transition. #### Properties ##### idle\_timeout\_seconds? > `optional` **idle\_timeout\_seconds?**: `number` New idle-stop duration in seconds, from 60 through 86400. Omit it to leave the current value unchanged. *** ##### metadata? > `optional` **metadata?**: `object` Replacement metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### state > **state**: `"running"` | `"stopped"` New desired lifecycle state. Omit it to leave lifecycle state unchanged. *** ##### ttl\_seconds? > `optional` **ttl\_seconds?**: `number` New positive lifetime in seconds from the time of this update. Omit it to leave expiry unchanged; zero is invalid. ### UpdateSandboxTtlRequest > **UpdateSandboxTtlRequest** = `object` A sandbox update that includes a new lifetime. #### Properties ##### idle\_timeout\_seconds? > `optional` **idle\_timeout\_seconds?**: `number` New idle-stop duration in seconds, from 60 through 86400. Omit it to leave the current value unchanged. *** ##### metadata? > `optional` **metadata?**: `object` Replacement metadata: at most 50 entries, keys at most 128 characters, and at most 4096 bytes of total value content. ###### Index Signature \[`key`: `string`]: `string` *** ##### state? > `optional` **state?**: `"running"` | `"stopped"` New desired lifecycle state. Omit it to leave lifecycle state unchanged. *** ##### ttl\_seconds > **ttl\_seconds**: `number` New positive lifetime in seconds from the time of this update. Omit it to leave expiry unchanged; zero is invalid. ### UpdateSandboxWorkspaceRequest > **UpdateSandboxWorkspaceRequest** = `object` A grow-only durable workspace capacity update. #### Properties ##### workspace\_capacity\_gib > **workspace\_capacity\_gib**: `number` New durable workspace capacity in whole GiB. It must be at least the current capacity; shrinking a workspace is unsupported. ### UsageServiceGetUsageSnapshotError > **UsageServiceGetUsageSnapshotError** = `UsageServiceGetUsageSnapshotErrors`\keyof \[`UsageServiceGetUsageSnapshotErrors`] ### UsageServiceGetUsageSnapshotErrors > **UsageServiceGetUsageSnapshotErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### UsageSnapshot > **UsageSnapshot** = `object` Point-in-time quota usage for the caller's org. #### Properties ##### limits? > `optional` **limits?**: `QuotaLimit`\[] Every configured product quota. ### Volume > **Volume** = `object` A volume record (the subset the API returns). #### Properties ##### created\_at? > `optional` **created\_at?**: `string` When the volume was created (RFC 3339). *** ##### created\_by? > `optional` **created\_by?**: `string` Stable id of the principal that created the volume — the API key (or user) that performed the create, recorded server-side. Resolve it to a display name via the principals listing. *** ##### current\_version\_digest? > `optional` **current\_version\_digest?**: `string` Digest of the volume's current (latest committed) version. Empty until the first push publishes a version. *** ##### description? > `optional` **description?**: `string` User-assigned free-text description (at most 4 KiB). Empty when unset. *** ##### id? > `optional` **id?**: `string` The volume id. *** ##### name? > `optional` **name?**: `string` The volume name — unique within its project. Limited to letters, digits, dots, dashes, and underscores (at most 100 characters). *** ##### project\_id? > `optional` **project\_id?**: `string` The project the volume belongs to. *** ##### quota\_bytes? > `optional` **quota\_bytes?**: `string` Storage quota in bytes: the cap on the volume's total committed size. A quota, not an allocation — an empty volume consumes no storage. *** ##### updated\_at? > `optional` **updated\_at?**: `string` When the volume record was last updated (RFC 3339). Equal to created\_at until the first update. *** ##### used\_bytes? > `optional` **used\_bytes?**: `string` Committed storage in bytes: the total size of the distinct content blobs referenced by the volume's versions. Content is stored deduplicated, so a blob shared by several versions counts once — this is what the volume's committed content occupies, not the sum of its versions' sizes. Zero for a volume with no committed versions. ### VolumeBlobRef > **VolumeBlobRef** = `object` One content blob (a whole small file, or one chunk of a larger file) the client intends to upload, identified by its digest. #### Properties ##### digest? > `optional` **digest?**: `string` The blob's content digest (`blake3:<hex>`). *** ##### size\_bytes? > `optional` **size\_bytes?**: `string` The blob's exact size in bytes. Verified against the stored object before a version referencing the blob can be published. ### VolumeBlobUpload > **VolumeBlobUpload** = `object` The upload decision for one requested blob. #### Properties ##### digest? > `optional` **digest?**: `string` The blob's content digest, echoed from the request. *** ##### present? > `optional` **present?**: `boolean` True when the blob already exists in the volume store — skip the upload; content is deduplicated by digest. *** ##### upload\_url? > `optional` **upload\_url?**: `string` Short-lived pre-authorized URL to PUT the blob's bytes to. Empty when `present` is true. The URL is bound to the blob's content-addressed location; the request needs no additional credentials. ### VolumeServiceCreateVolumeError > **VolumeServiceCreateVolumeError** = `VolumeServiceCreateVolumeErrors`\keyof \[`VolumeServiceCreateVolumeErrors`] ### VolumeServiceCreateVolumeErrors > **VolumeServiceCreateVolumeErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### VolumeServiceDeleteVolumeError > **VolumeServiceDeleteVolumeError** = `VolumeServiceDeleteVolumeErrors`\keyof \[`VolumeServiceDeleteVolumeErrors`] ### VolumeServiceDeleteVolumeErrors > **VolumeServiceDeleteVolumeErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### VolumeServiceGetVolumeError > **VolumeServiceGetVolumeError** = `VolumeServiceGetVolumeErrors`\keyof \[`VolumeServiceGetVolumeErrors`] ### VolumeServiceGetVolumeErrors > **VolumeServiceGetVolumeErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### VolumeServiceListVolumesError > **VolumeServiceListVolumesError** = `VolumeServiceListVolumesErrors`\keyof \[`VolumeServiceListVolumesErrors`] ### VolumeServiceListVolumesErrors > **VolumeServiceListVolumesErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### VolumeServicePublishVolumeVersionError > **VolumeServicePublishVolumeVersionError** = `VolumeServicePublishVolumeVersionErrors`\keyof \[`VolumeServicePublishVolumeVersionErrors`] ### VolumeServicePublishVolumeVersionErrors > **VolumeServicePublishVolumeVersionErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### VolumeServiceRequestVolumeBlobUploadsError > **VolumeServiceRequestVolumeBlobUploadsError** = `VolumeServiceRequestVolumeBlobUploadsErrors`\keyof \[`VolumeServiceRequestVolumeBlobUploadsErrors`] ### VolumeServiceRequestVolumeBlobUploadsErrors > **VolumeServiceRequestVolumeBlobUploadsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### VolumeServiceStartVolumePushError > **VolumeServiceStartVolumePushError** = `VolumeServiceStartVolumePushErrors`\keyof \[`VolumeServiceStartVolumePushErrors`] ### VolumeServiceStartVolumePushErrors > **VolumeServiceStartVolumePushErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### VolumeVersion > **VolumeVersion** = `object` One immutable, committed volume version. The digest of the version's manifest (the canonical file listing) is the version's identity: identical content under the same parent always yields the same digest, and a version can never change after it is published. #### Properties ##### created\_at? > `optional` **created\_at?**: `string` When the version was published (RFC 3339). *** ##### created\_by? > `optional` **created\_by?**: `string` Stable id of the principal that published the version, recorded server-side. *** ##### file\_count? > `optional` **file\_count?**: `string` Number of files in the version. *** ##### parent\_version\_digest? > `optional` **parent\_version\_digest?**: `string` The digest of the version this one was published on top of. Empty for a volume's first version. *** ##### size\_bytes? > `optional` **size\_bytes?**: `string` Total content size in bytes across all files in the version. *** ##### version\_digest? > `optional` **version\_digest?**: `string` The version's identity: the digest of its manifest (`blake3:<hex>`). *** ##### volume\_id? > `optional` **volume\_id?**: `string` The volume this version belongs to. ### WhoAmIResponse > **WhoAmIResponse** = `object` #### Properties ##### organization? > `optional` **organization?**: `OrgRef` The organization the caller acts in. *** ##### principal? > `optional` **principal?**: `Principal` The acting principal. ### Workload > **Workload** = `object` A registered workload identity, scoped to the caller's organization. #### Properties ##### created\_at? > `optional` **created\_at?**: `string` When the workload was registered (RFC 3339). *** ##### created\_by? > `optional` **created\_by?**: `string` Stable id of the principal that registered the workload, when recorded. *** ##### description? > `optional` **description?**: `string` A free-text description of what the workload is for. May be empty. *** ##### federation\_configs? > `optional` **federation\_configs?**: `WorkloadFederationConfig`\[] Live cloud-federation registrations owned by this workload, in creation order. *** ##### id? > `optional` **id?**: `string` The workload's stable id. *** ##### launch\_acl? > `optional` **launch\_acl?**: `WorkloadLaunchAcl` Who may launch as this workload. *** ##### name? > `optional` **name?**: `string` The workload's registered name — unique within the organization, and how the workload is displayed in attribution everywhere. Lowercase letters, digits, `.`, `_`, and `-`; must start and end with a letter or digit; at most 100 characters. *** ##### updated\_at? > `optional` **updated\_at?**: `string` When the workload's registration or ACL was last changed (RFC 3339). ### WorkloadFederationConfig > **WorkloadFederationConfig** = `object` One live cloud-federation registration owned by a workload. The audience is provider-canonical and server-derived from cloud and descriptor; it is the exact value the workload may request from the workload-identity issuer. #### Properties ##### audience? > `optional` **audience?**: `string` Exact provider audience admitted for this workload. *** ##### cloud? > `optional` **cloud?**: `string` Cloud provider: aws, gcp, or azure. *** ##### created\_at? > `optional` **created\_at?**: `string` When the registration was created (RFC 3339). *** ##### created\_by? > `optional` **created\_by?**: `string` Stable id of the principal that created the registration, when recorded. *** ##### descriptor? > `optional` **descriptor?**: `WorkloadFederationDescriptor` Strict parameters for the selected cloud. *** ##### id? > `optional` **id?**: `string` Stable handle used by federation list, remove, and setup. *** ##### workload\_id? > `optional` **workload\_id?**: `string` Stable id of the workload that owns this registration. ### WorkloadFederationDescriptor > **WorkloadFederationDescriptor** = `object` Cloud-specific parameters for one workload federation registration. Only the fields belonging to the selected cloud may be set. AWS requires role\_arn and defaults an empty region to us-east-1. Google Cloud requires project\_id, project\_number, pool\_id, and provider\_id; service\_account\_email is optional. Microsoft Entra requires application\_id and entra\_tenant\_id. #### Properties ##### application\_id? > `optional` **application\_id?**: `string` Microsoft Entra application (client) id. *** ##### entra\_tenant\_id? > `optional` **entra\_tenant\_id?**: `string` Microsoft Entra tenant id. *** ##### pool\_id? > `optional` **pool\_id?**: `string` Google Cloud workload identity pool id. *** ##### project\_id? > `optional` **project\_id?**: `string` Google Cloud project id. *** ##### project\_number? > `optional` **project\_number?**: `string` Google Cloud project number. *** ##### provider\_id? > `optional` **provider\_id?**: `string` Google Cloud workload identity provider id. *** ##### region? > `optional` **region?**: `string` AWS region used by the generated SDK configuration. Defaults to us-east-1. *** ##### role\_arn? > `optional` **role\_arn?**: `string` AWS IAM role trusted by this workload. *** ##### service\_account\_email? > `optional` **service\_account\_email?**: `string` Optional Google Cloud service account to impersonate. ### WorkloadLaunchAcl > **WorkloadLaunchAcl** = `object` A per-workload launch ACL: which principals may launch a run or sandbox as the workload. #### Properties ##### launchers? > `optional` **launchers?**: `WorkloadLauncher`\[] The principals allowed to launch as this workload. Meaningful only when the policy is WORKLOAD\_LAUNCH\_POLICY\_RESTRICTED; empty otherwise. *** ##### policy? > `optional` **policy?**: `"WORKLOAD_LAUNCH_POLICY_UNSPECIFIED"` | `"WORKLOAD_LAUNCH_POLICY_MEMBERS"` | `"WORKLOAD_LAUNCH_POLICY_RESTRICTED"` The launch policy: open to all org members, or restricted to the listed launchers. ### WorkloadLauncher > **WorkloadLauncher** = `object` One launch-ACL entry: a principal allowed to launch as the workload. #### Properties ##### kind? > `optional` **kind?**: `string` The kind of principal this entry names: `user` (an org member, named by user id — also the meaning of an unset kind) or `service_account` (a service-account API key, named by key id). Any other value is rejected. *** ##### principal\_id? > `optional` **principal\_id?**: `string` The principal's stable id: a user id for `user`, a service-account key id for `service_account`. ### WorkloadServiceAddWorkloadFederationError > **WorkloadServiceAddWorkloadFederationError** = `WorkloadServiceAddWorkloadFederationErrors`\keyof \[`WorkloadServiceAddWorkloadFederationErrors`] ### WorkloadServiceAddWorkloadFederationErrors > **WorkloadServiceAddWorkloadFederationErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### WorkloadServiceCreateWorkloadError > **WorkloadServiceCreateWorkloadError** = `WorkloadServiceCreateWorkloadErrors`\keyof \[`WorkloadServiceCreateWorkloadErrors`] ### WorkloadServiceCreateWorkloadErrors > **WorkloadServiceCreateWorkloadErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### WorkloadServiceDeleteWorkloadError > **WorkloadServiceDeleteWorkloadError** = `WorkloadServiceDeleteWorkloadErrors`\keyof \[`WorkloadServiceDeleteWorkloadErrors`] ### WorkloadServiceDeleteWorkloadErrors > **WorkloadServiceDeleteWorkloadErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### WorkloadServiceGetWorkloadError > **WorkloadServiceGetWorkloadError** = `WorkloadServiceGetWorkloadErrors`\keyof \[`WorkloadServiceGetWorkloadErrors`] ### WorkloadServiceGetWorkloadErrors > **WorkloadServiceGetWorkloadErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### WorkloadServiceListWorkloadFederationError > **WorkloadServiceListWorkloadFederationError** = `WorkloadServiceListWorkloadFederationErrors`\keyof \[`WorkloadServiceListWorkloadFederationErrors`] ### WorkloadServiceListWorkloadFederationErrors > **WorkloadServiceListWorkloadFederationErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### WorkloadServiceListWorkloadsError > **WorkloadServiceListWorkloadsError** = `WorkloadServiceListWorkloadsErrors`\keyof \[`WorkloadServiceListWorkloadsErrors`] ### WorkloadServiceListWorkloadsErrors > **WorkloadServiceListWorkloadsErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### WorkloadServiceRemoveWorkloadFederationError > **WorkloadServiceRemoveWorkloadFederationError** = `WorkloadServiceRemoveWorkloadFederationErrors`\keyof \[`WorkloadServiceRemoveWorkloadFederationErrors`] ### WorkloadServiceRemoveWorkloadFederationErrors > **WorkloadServiceRemoveWorkloadFederationErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope. ### WorkloadServiceSetWorkloadLaunchAclError > **WorkloadServiceSetWorkloadLaunchAclError** = `WorkloadServiceSetWorkloadLaunchAclErrors`\keyof \[`WorkloadServiceSetWorkloadLaunchAclErrors`] ### WorkloadServiceSetWorkloadLaunchAclErrors > **WorkloadServiceSetWorkloadLaunchAclErrors** = `object` #### Properties ##### 429 > **429**: `ErrorBody` A quota or rate-limit rejection. *** ##### default > **default**: `ErrorBody` An error using the standard hiloop error envelope.